Skip to main content

Privacy Policy

Last updated: October 2026

1. Introduction

Nolorem ("we", "our", or "us") is operated by Bonalogic. This Privacy Policy explains how we collect, use, share, and protect your personal data when you use our platform at nolorem.io.

We are committed to protecting your privacy and processing your personal data in accordance with the General Data Protection Regulation (GDPR) and other applicable data protection laws.

2. Data Controller

The data controller responsible for your personal data is:

  • Company: Bonalogic
  • Platform: Nolorem (nolorem.io)
  • Privacy contact: info@nolorem.io

3. Data We Collect

We collect the following categories of personal data:

Account Information

Name, email address, and organization details provided during signup and account management.

Usage Data

Pages visited, features used, interaction patterns, and timestamps to improve our service and understand usage.

Content Data

Blog posts, social media content, research queries, outlines, and other materials you create or generate through the platform, including the version of each text before and after your edits.

Payment Data

Billing information processed securely through Stripe, including your email and subscription details. We do not store credit card numbers on our servers.

Technical Data

IP address, browser type, device information, operating system, and referring URLs collected automatically when you access the platform.

If you react to a post of a Nolorem customer

If a business uses Nolorem to publish posts and you react to one, Nolorem stores your reaction for that business: your name as the platform shows it, your platform id, the link to your profile and profile picture, the text of your reaction, the time, and the number of likes and replies. The business is the controller; Nolorem processes this data on the business's instructions and does not use it for its own purposes.

4. How We Use Your Data

Your data is used for the following purposes:

  • Service delivery: Providing and maintaining the Nolorem platform, including content creation, scheduling, and publishing features.
  • Billing: Processing payments, managing subscriptions, and issuing invoices through Stripe.
  • Transactional emails: Sending account confirmations, billing receipts, publishing notifications, and trial expiration warnings via Resend.
  • AI content generation: Processing your prompts, topics, and outlines through AI providers (Anthropic, OpenAI) to generate blog posts and social media content.
  • Image generation: Processing image prompts through Fal.ai to create AI-generated images for your content.
  • Research: Using Perplexity and Tavily to gather research data for your content topics.
  • Analytics improvement: Analyzing anonymized usage patterns to improve features and user experience.
  • Improving your own generations: Nolorem keeps, for each text it generates for you, the text as it was generated and the text as you sent or scheduled it, with the channel, the voice profile, the language and the kind of content, to be able to improve your own generations. Whatever can be learned from the edits of an organisation serves that organisation only. It is never used for other customers and never to train a model. Internal analysis runs on figures without customer names.

The business uses your reaction to read it and to answer it. At the business's request, an AI provider (Anthropic, OpenAI as fallback) may read your name and the text of your reaction to write a proposed answer; a human reads and sends that answer. This happens only when the business asks for it. Legal basis: the business's legitimate interest in answering the reactions under its own posts.

We process your personal data on the following legal bases under GDPR Article 6:

  • Contract performance (Art. 6(1)(b)): Processing necessary to deliver the services you subscribed to, including content generation, publishing, and account management.
  • Legitimate interests (Art. 6(1)(f)): Service improvement through anonymized analytics, fraud prevention, and platform security.
  • Consent (Art. 6(1)(a)): Non-essential cookies and any future marketing communications. You may withdraw consent at any time.

6. Data Sharing & Sub-processors

We share your data with third-party sub-processors only as necessary to deliver the Service. We do not sell your personal data. Our sub-processors include:

  • Stripe: Payment processing
  • Anthropic: AI text generation (primary)
  • OpenAI: Rewriting pass on generated blog articles, searchable text fragments (embeddings), and fallback for text generation and language review
  • Google: Reserve text generation, only when Anthropic and OpenAI are both unavailable
  • Fal.ai: AI image generation
  • bundle.social: Social media scheduling & publishing
  • Apify: Content discovery scraping
  • DataForSEO: Keyword research
  • Perplexity: AI research (primary)
  • Tavily: AI research (fallback)
  • Resend: Transactional email
  • Backblaze: Encrypted off-site backups of the database and stored files
  • Hostinger: Server hosting (VPS in Frankfurt) on which the platform runs

Your reaction is retrieved through bundle.social. Only when the business asks for a proposed answer do your name and the text of your reaction go to the AI provider (Anthropic or OpenAI). See the Data Processing Agreement for the full list.

For full details on each sub-processor, including data categories and locations, see our Data Processing Agreement.

7. International Transfers

Some of our sub-processors are based in the United States. Where personal data is transferred outside the European Economic Area (EEA), we ensure appropriate safeguards are in place, including EU Standard Contractual Clauses (SCCs) as approved by the European Commission.

8. Data Retention

We keep the personal data below only for as long as it serves the purpose it was collected for. The periods are:

  • Request logs and IP addresses: Kept for 90 days, then deleted. This lets us detect a shared or abused API key and investigate recent suspicious traffic.
  • Administrative access records: Kept for 24 months. After that period the identifying details in the record are replaced so it can no longer be traced to the person or workspace involved, while the fact that access took place is kept for accountability.
  • AI generation and audit records: Kept for 12 months, then deleted. These are operational records used to diagnose issues and measure cost, not a copy of the content you created. The text before and after your edits is kept separately, as described in the next line.
  • Text before and after your edits: Kept for 12 months, or deleted earlier as soon as the post or article is definitively deleted, which includes emptying the trash, or when the organisation is deleted. A post or article in the trash keeps its text pairs until it is definitively deleted or until the 12 months are over. This is a separate retention next to the AI generation and audit records.
  • Conversations with the assistant: Kept for 12 months after the last message, then deleted. Only you can see your conversations in the app, not the administrators of your workspace. You can delete a conversation yourself at any time, and your conversations in a workspace are deleted when you leave it or are removed from it. A Nolorem administrator can view a conversation only to check a complaint or when you ask us to, and every such view is recorded with its reason.
  • Technical record of each answer: For each answer from the assistant we keep a technical record of which document passages and data the answer used and what it changed. We do this so that errors can be traced. The content of that record is deleted after 30 days. After that only characteristics without content remain, for as long as the conversation exists, and the conversation itself is kept for 12 months after the last message. The record disappears with the conversation or with your organisation, and it is part of your data export.
  • What the assistant remembers within a conversation: Alongside a conversation we keep a short ledger of references and statuses: which proposals you accepted or declined, which suggestion cards were applied, and which figures the assistant already mentioned, so it can notice when a figure has since changed. It holds no copy of your documents and no free text apart from wording you chose yourself. The ledger is kept as long as the conversation (12 months after the last message) and disappears with it or with your organisation, and it is part of your data export.
  • Records of a conversation being viewed: Kept for 24 months, then deleted. A record names who viewed which conversation, when, whose conversation it was, and the reason chosen from a fixed list. It is kept for the full 24 months even if the conversation itself is deleted earlier.
  • In-app notifications: Kept for 6 months after you have read them, then deleted. A notification you have not read yet is kept until you read it, however old it is.
  • Last activity time: One timestamp showing when you were last active in the app, overwritten each time you use it. No history is kept, and it is deleted together with your account.
  • Invitations: The invited person's email address is removed 30 days after an invitation is accepted, expires or is withdrawn. A pending invitation keeps the address until it reaches one of those outcomes. What stays afterwards is a record that an invitation existed, without the address.
  • Marketing signups: Kept for 24 months, or removed earlier if you ask us to.
  • Reactions from third parties: kept for as long as the business keeps the post you reacted to. Nolorem retrieves reactions until about 30 days after the post was published. If you remove your reaction on the platform before that point, it also disappears at Nolorem at the next retrieval. If you remove it afterwards, it stays at Nolorem until the business deletes the post definitively. After that it is gone.

9. Records Kept After Erasure

When you exercise your right to erasure, your personal data is deleted or made anonymous. Three kinds of record continue to exist afterwards, and none of them identifies you.

  • Records of administrative access: If a Nolorem administrator ever accessed your workspace, for example while helping with a support request, the record that this happened is kept. The details that identified you or the administrator are replaced so the record can no longer be traced to either of you. We keep it on the basis of accountability, so we can show, if ever asked, that access to a workspace took place and was recorded, without that record naming anyone.
  • Records of a conversation being viewed: If a Nolorem administrator viewed one of your conversations to check a complaint, the record that this happened is kept until its 24 months have passed. The conversation itself is deleted, but the record stays, with the administrator, the time, the reason and whose conversation it was. If your account is deleted, the record no longer names you.
  • A record that you made this request: We keep a record that a data subject request was received and when it was answered, so we can show that we met the legal deadline. This record does not include the personal data you asked us to erase.
  • Exclusion list for reactions: only your platform id and the date of erasure, on an exclusion list for the business's workspace. Nothing else is on it.

10. Anonymous Feedback

Feedback you leave on our support articles, for example rating whether an article helped or leaving a comment, is not linked to your account or to any other personal data. Because we never connect it to who you are, we cannot trace it back to you or recognise it as yours to remove on request. It falls outside the scope of an erasure request for that reason: there is no personal data in it to erase.

11. Data Held By Our Payment Processor

Your name, billing address, payment details and invoices are held by Stripe, our payment processor, under Stripe's own legal obligation to retain financial records for tax purposes. Nolorem does not hold this data directly and cannot delete it from Stripe's systems when you delete your account.

Your personal data file describes what Stripe holds about you rather than including it, because it exists in Stripe's systems under Stripe's own privacy notice. You can obtain your invoices and billing details from Stripe through your billing portal, or by asking us.

12. Your Rights

Under GDPR and applicable privacy laws, you have the following rights regarding your personal data:

  • Right of access: Request a copy of the personal data we hold about you. You can download this yourself at any time as a personal data file, without needing to contact us.
  • Right to rectification: Request correction of inaccurate or incomplete personal data.
  • Right to erasure: Request deletion of your personal data ("right to be forgotten").
  • Right to data portability: Request your data in a structured, commonly used, machine-readable format. Your personal data file already meets this; an organization administrator can additionally request a full export of everything held for the workspace.
  • Right to restrict processing: Request that we limit how we use your data.
  • Right to object: Object to processing based on legitimate interests.
  • Right to withdraw consent: Withdraw consent at any time where processing is based on consent.
  • Right to lodge a complaint: File a complaint with your local data protection supervisory authority.

Access, erasure and portability are self-service: you run them yourself from Settings, Data Export, or from the account settings page. Restriction, objection and withdrawal of consent have no screen in the platform, because each one is a judgement about a specific processing activity rather than a switch; ask us by email and we apply them by hand, within the same 30 days.

Do you want your reactions removed? Ask the business under whose post you reacted, or write to Nolorem at the contact address at the bottom of this page; we forward your request to the business, which is the controller. An administrator of Nolorem then erases, within 15 working days after the business confirms, your reactions in that business's workspace, and also the answers the business gave you in Nolorem. The answer on the platform itself stays; the business manages that there. To stop your reactions from returning at the next retrieval, we keep only your platform id and the date of erasure on an exclusion list for that workspace. Nothing else is on it. Nolorem does not remove your reaction on the platform itself; you or the platform do that.

To exercise any of these rights, contact us at info@nolorem.io. We will respond within 30 days.

13. Cookies

We use essential cookies required for the platform to function, including authentication and session management. By default, we do not set non-essential tracking cookies.

If you have accepted non-essential cookies via our cookie consent banner, we may use analytics cookies to understand usage patterns. You can change your cookie preferences at any time using the "Cookie Preferences" link in the site footer.

14. Children

Nolorem is not directed at individuals under the age of 16. We do not knowingly collect personal data from children. If you believe we have inadvertently collected data from a child under 16, please contact us at info@nolorem.io and we will promptly delete it.

15. Changes

We may update this Privacy Policy from time to time. For material changes, we will notify you via email at the address associated with your account. The "Last updated" date at the top of this page indicates when the policy was last revised.

16. Contact

For privacy-related inquiries, data subject requests, or concerns about how we handle your personal data, contact us at: